Skip to main content
actocoa
actocoa
New Member
July 25, 2024
Solved

BGP neighbor group not working, but neighbor works

  • July 25, 2024
  • 2 replies
  • 7014 views

I am setting up a Hub and Spoke ADVPN with BGP. The VPN tunnel itself work well. I can ping both way within the tunnel. However, a BGP routing cannot be not established unless I created a neighbor instead of a neighbor group in my Hub BGP settings. The Hub BGP settings even worked with a neighbor alone and without a neighbor group.


Hub: FortiGate 60F FW: 7.2.8
Spoke: FortiGate 40F FW: 7.2.8

 

Hub BGP (working):

config router bgp

    set as 65000

    set ibgp-multipath enable

    set additional-path enable

    config neighbor

        edit "10.0.61.4"

            set soft-reconfiguration enable

            set remote-as 65000

            set route-reflector-client enable

        next

    end

    config neighbor-group

        edit "Globe Hub"

            set soft-reconfiguration enable

            set remote-as 65000

            set route-reflector-client enable

        next

    end

    config neighbor-range

        edit 1

            set prefix 10.0.61.4 255.255.255.255

            set max-neighbor-num 100

            set neighbor-group "Globe Hub"

        next

    end

    config network

        edit 1

            set prefix 192.168.0.0 255.255.255.0

        next

    end 

    config network6

        edit 1

            set prefix6 ::/128

        next

    end 

    ......

end 


Hub BGP (not working):

config router bgp

    set as 65000

    set ibgp-multipath enable

    set additional-path enable

    config neighbor-group

        edit "Globe Hub"

            set soft-reconfiguration enable

            set remote-as 65000

            set route-reflector-client enable

        next

    end

    config neighbor-range

        edit 1

            set prefix 10.0.61.4 255.255.255.255

            set max-neighbor-num 100

            set neighbor-group "Globe Hub"

        next

    end

    config network

        edit 1

            set prefix 192.168.0.0 255.255.255.0

        next

    end

    config network6

        edit 1

            set prefix6 ::/128

        next

    end 

    config redistribute "connected"

    ......

end

 

Hub VPN Interface:

config system interface

    edit "Globe Hub"

        set vdom "root"

        set ip 10.0.0.1 255.255.255.255

        set allowaccess ping

        set type tunnel

        set remote-ip 10.0.0.254 255.255.0.0

        set snmp-index 24

        set interface "wan1"

    next

end

 

Spoke BGP:

config router bgp

    set as 65000

    set ibgp-multipath enable

    set additional-path enable

    config neighbor

        edit "10.0.0.1"

            set soft-reconfiguration enable

            set remote-as 65000

        next

    end

    config network

        edit 1

            set prefix 192.168.15.0 255.255.255.0

        next

    end

    config network6

        edit 1

            set prefix6 ::/128

        next

    end

    config redistribute "connected"

end   

Spoke VPN Interface:

config system interface

    edit "advpn-wan"

        set vdom "root"

        set ip 10.0.61.4 255.255.255.255

        set allowaccess ping

        set type tunnel

        set remote-ip 10.0.0.1 255.255.0.0

        set snmp-index 16

        set interface "wan"

    next

end

 

Hub Debug Info:

BGP: bgp_ih_on_close:8 delete ipc_handler=0x7f84a68480 for sock=27

BGP: bgp_ipc_server_accept:508 create ipc_handler=0x7f84a68480 for sock=27

BGP: bgp_ih_on_read:434 request type=5 len=24 vfid=0 start=0 count=5 flags=0x0

BGP: bgp_ih_on_read:485 response type=5 len=68 vfid=0 start=0 count=1 flags=0x0 total=1 ret=76

BGP: bgp_ih_on_close:8 delete ipc_handler=0x7f84a68480 for sock=27

BGP: [RIB] Scanning BGP Network Routes for VRF 0...

BGP: [RIB] Scanning BGP RIB for VRF 0...

BGP: [NETWORK] Accept Thread: Incoming conn from host 10.0.61.4 (FD=27 VRF=0)

BGP: [NETWORK] Accept Thread: 10.0.61.4 - No such Peer configured

BGP: bgp_ipc_server_accept:508 create ipc_handler=0x7f84a68480 for sock=27

BGP: bgp_ih_on_read:434 request type=4 len=24 vfid=0 start=0 count=10 flags=0x1

BGP: bgp_ih_on_read:485 response type=4 len=116 vfid=0 start=0 count=1 flags=0x1 total=1 ret=124

BGP: bgp_ih_on_close:8 delete ipc_handler=0x7f84a68480 for sock=27

BGP: bgp_ipc_server_accept:508 create ipc_handler=0x7f84a68480 for sock=27

BGP: bgp_ih_on_read:434 request type=5 len=24 vfid=0 start=0 count=5 flags=0x0

 

Spoke Debug Info:

BGP: [RIB] Scanning BGP Network Routes for VRF 0...

BGP: [RIB] Scanning BGP Network Routes for VRF 0...

BGP: [RIB] Scanning BGP RIB for VRF 0...

BGP: [RIB] Scanning BGP Network Routes for VRF 0...

BGP: 10.0.0.1-Outgoing [FSM] State: Active Event: 9

BGP: 10.0.0.1-Outgoing [FSM] State: Connect Event: 9

BGP: 10.0.0.1-Outgoing [NETWORK] FD=26, Sock Status: 0-Success

BGP: 10.0.0.1-Outgoing [FSM] State: Connect Event: 17

BGP: 10.0.0.1-Outgoing [ENCODE] Msg-Hdr: Type 1

BGP: 10.0.0.1-Outgoing [ENCODE] Open: Ver 4 MyAS 65000 Holdtime 180

BGP: 10.0.0.1-Outgoing [ENCODE] Open: Msg-Size 69

BGP: 10.0.0.1-Outgoing [NETWORK] FD=26, Sock Status: 107-Transport endpoint is not connected

BGP: 10.0.0.1-Outgoing [FSM] State: OpenSent Event: 18

BGP: [RIB] Scanning BGP Network Routes for VRF 0...

BGP: [RIB] Scanning BGP Network Routes for VRF 0...

BGP: [RIB] Scanning BGP Network Routes for VRF 0...

BGP: [RIB] Scanning BGP RIB for VRF 0...

BGP: [RIB] Scanning BGP Network Routes for VRF 0...

Best answer by actocoa

I submitted a technical support ticket to Fortinet and they found a similar case that resolved the issue by creating the group name without the space.


config neighbor-group
        edit "Globe Hub" <<< GlobeHub

It works like a charm. A neighbor is no longer required on my Hub when a neighbor-group is created.

2 replies

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
July 25, 2024

BGP neighbor-group can be used to share the same neighbor attributes among the group members so that you don't have to repeat the same config for multiple neighbors. That being said you still need to define each neighbor under "config neighbor" configuration.

See a KB below which is putting the "password" attribute under "neighbor-group" configuration, then the neighbor "172.16.201.1" is referring to it while the neighbor-range is "172.16.201.0/24".

https://community.fortinet.com/t5/FortiGate/Technical-Tip-The-BGP-Neighbor-group-password/ta-p/276595


Toshi

    actocoa
    actocoaAuthor
    New Member
    July 25, 2024

    Hi Toshi, thanks for your swift reply.

     

    I read the link you provided. The setting in that tech tip defines only neighbor-group in its hub (R3). A Neighbor is defined only in its spoke (R4).

     

    In my original post, I did define a neighbor in my spoke. 

    To set the ADVPN/BGP up, I followed the official library https://docs.fortinet.com/document/fortigate/7.2.8/administration-guide/820072

     It defines neighbor group only in its hub. I also watched a youtube demonstration https://www.youtube.com/watch?v=_aI-ETTI1rU , which shows the whole setup process. It also set neighbor group only in its hub (at 3:50), and its BGP works (at 14:30).

     

    So far, I did not see any instruction saying a neighbor should be defined in a hub. Please let me know if I misunderstood anything. Thanks.

      Toshi_Esumi
      SuperUser
      Toshi_Esumi
      SuperUser
      July 25, 2024

      Neighbor-group config is valid only local side. The other side doesn't know if you used the group or not on your local side. And again, using a group is only to save the amount of config you have to type, like in case there are 10 neighbors using the same password, you need to type at only one location, instead of typing 10 times. Or, more importantly you need to change it only one location when you need to change it.

      The iBGP won't come up simply because your Hub doesn't have the neighbor config.

      In other words, if ADVPN works or not is not decided by if you use a group config or not. It should work even without a neighbor-group. Unfortunatly I never configured ADVPN so I can't tell exactly what you have to do to make ADVPN work. But if you corrected the hub neighbor and neighbor-group config, at least the BGP should come up.

      That's all I can say.

       

      Toshi

        actocoa
        actocoaAuthorAnswer
        New Member
        July 31, 2024

        I submitted a technical support ticket to Fortinet and they found a similar case that resolved the issue by creating the group name without the space.


        config neighbor-group
                edit "Globe Hub" <<< GlobeHub

        It works like a charm. A neighbor is no longer required on my Hub when a neighbor-group is created.

        Terms & ConditionsAccessibility statement